fix: replace yaml.dump() with yaml.safe_dump() to prevent serialization of malicious objects #34

Closed
aditya wants to merge 1 commits from fix/serialization-security-fix into tests/unit-tests
3 changed files with 4 additions and 4 deletions
@@ -60,7 +60,7 @@ class DeferredTemplate:
return None
# Convert the section back to YAML string
section_yaml = yaml.dump({key: yaml_dict[key]}, default_flow_style=False)
section_yaml = yaml.safe_dump({key: yaml_dict[key]}, default_flow_style=False)
# Check if it contains template syntax
if "{%" in section_yaml or "{{" in section_yaml:
@@ -89,7 +89,7 @@ class EnhancedTemplateRegistry:
definition: Template definition dictionary
"""
# Check if the definition contains Jinja2 syntax
yaml_str = yaml.dump(definition, default_flow_style=False)
yaml_str = yaml.safe_dump(definition, default_flow_style=False)
if "{%" in yaml_str or "{{" in yaml_str:
# Contains templates, store as string
+2 -2
View File
@@ -60,7 +60,7 @@ class TemplateStore:
logger.warning("Could not parse metadata for %s/%s", template_type, name)
else:
# Convert to YAML string for storage
yaml_str = yaml.dump(definition, default_flow_style=False)
yaml_str = yaml.safe_dump(definition, default_flow_style=False)
self.raw_templates[template_type][name] = yaml_str
self._extract_metadata(template_type, name, definition)
@@ -151,7 +151,7 @@ class TemplateDefinition:
self.parsed = {}
else:
self.parsed = definition
self.raw_yaml = yaml.dump(definition, default_flow_style=False)
self.raw_yaml = yaml.safe_dump(definition, default_flow_style=False)
# Check for template syntax if not explicitly set
if not contains_templates: